Dependabot does not update to latest preview version

[jongio]

Looks like Dependabot isn't updating to latest preview version. According to comments in #1842 it should work.

I have 1.2.0-preview.1 in my csproj

https://github.com/jongio/azidext/blob/master/net/JonGallant.Azure.Identity.Extensions/JonGallant.Azure.Identity.Extensions.csproj#L15

<PackageReference Include="Azure.Identity" Version="1.2.0-preview.1" />

The latest published version is 1.2.0-preview.4:
https://www.nuget.org/packages/Azure.Identity/1.2.0-preview.4

I have dependabot.yml here:
https://github.com/jongio/azidext/blob/master/.github/dependabot.yml

I try to manually bump the version via Insights -> Dependency Graph -> Dependabot

I click "check now".

The version is not updated and this is in config.

updater | INFO <job_31991486> Checking if Azure.Identity 1.2.0-preview.1 needs updating
  proxy | 2020/06/20 16:56:50 GET https://api-v2v3search-0.nuget.org:443/query?q=azure.identity&prerelease=true
  proxy | 2020/06/20 16:56:50 200 https://api-v2v3search-0.nuget.org:443/query?q=azure.identity&prerelease=true
updater | INFO <job_31991486> Latest version is 1.1.1
updater | INFO <job_31991486> No update needed for Azure.Identity 1.2.0-preview.1
updater | INFO <job_31991486> Finished job processing
updater | time="2020-06-20T16:56:50Z" level=info msg="task complete" container_id=job-31991486-updater exit_code=0 job_id=31991486 step=updater

As you can see it thinks 1.1.1 is the latest version, but 1.2.0-preview.4 is the latest version.

Thanks
Jon

Related: #1926

azsdke2e

[Danielku15]

I just stumbled over this issue as part of my fix I am preparing in #4749 It seems the NuGet API does not include any prereleases if you just set prerelease=true.

Like in my case this search URL does NOT include prereleases:
https://azuresearch-usnc.nuget.org/query?q=coderline/alphatab&prerelease=true

But if I also specify semVerLevel it delivers all prereleases:
https://azuresearch-usnc.nuget.org/query?q=coderline/alphatab&prerelease=true&semVerLevel=2.0.0

(Search endpoint taken from https://api.nuget.org/v3/index.json). As NuGet nowadays is quite heavily dependent on SemVer 2 I wonder if it would be OK to only activate it for SemVer 2.0.0 by adding the parameter here:

dependabot-core/nuget/lib/dependabot/nuget/update_checker/repository_finder.rb

Line 62 in 9c4ab72

search_url + "?q=#{dependency.name.downcase}&prerelease=true"

SemVer 1.0.0 did only allow [0-9A-Za-z-] (alphanumeric with dash) but in our case we also have additional dots which is only allowed in SemVer 2.0.0

https://docs.microsoft.com/en-us/nuget/api/search-query-service-resource
https://semver.org/spec/v2.0.0.html
https://semver.org/spec/v1.0.0.html

Related PR to fix it: #4255

[Nishnha]

Hi @jongio,

The two PRs that @Danielku15 mentioned are merged and this should be fixed.

We have another known issue with build version extensions (#4845) that we are addressing, but the preview semver v2 extensions should behave as expected.